@solongate/proxy 0.82.42 → 0.82.44

package/dist/index.js

@@ -6187,6 +6187,476 @@ var init_cli_utils = __esm({
   }
 });
 
+// src/global-install.ts
+var global_install_exports = {};
+__export(global_install_exports, {
+  clearGuardUpdateCheck: () => clearGuardUpdateCheck,
+  globalPaths: () => globalPaths,
+  guardHookOutdated: () => guardHookOutdated,
+  installClaudeShim: () => installClaudeShim,
+  installGlobalQuiet: () => installGlobalQuiet,
+  installGlobalWithKey: () => installGlobalWithKey,
+  installedGuardVersion: () => installedGuardVersion,
+  isGuardInstalled: () => isGuardInstalled,
+  lockProtected: () => lockProtected,
+  removeClaudeShim: () => removeClaudeShim,
+  runGlobalInstall: () => runGlobalInstall,
+  runGlobalRestore: () => runGlobalRestore,
+  uninstallGlobalQuiet: () => uninstallGlobalQuiet,
+  unlockProtected: () => unlockProtected
+});
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2 } from "fs";
+import { resolve as resolve3, join as join4, dirname } from "path";
+import { homedir as homedir2 } from "os";
+import { fileURLToPath } from "url";
+import { createInterface } from "readline";
+import { execFileSync as execFileSync2 } from "child_process";
+function lockFile(file) {
+  if (!existsSync3(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function unlockFile(file) {
+  if (!existsSync3(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function protectedTargets() {
+  const p = globalPaths();
+  return [
+    join4(p.hooksDir, "guard.mjs"),
+    join4(p.hooksDir, "audit.mjs"),
+    join4(p.hooksDir, "stop.mjs"),
+    join4(p.hooksDir, "shield.mjs"),
+    p.configPath,
+    p.settingsPath,
+    p.antigravityHooksPath
+  ];
+}
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
+function unlockProtected() {
+  for (const f of protectedTargets()) unlockFile(f);
+}
+function globalPaths() {
+  const home = homedir2();
+  const sgDir = join4(home, ".solongate");
+  const hooksDir = join4(sgDir, "hooks");
+  const claudeDir = join4(home, ".claude");
+  const antigravityDir = join4(home, ".gemini", "config");
+  return {
+    home,
+    sgDir,
+    hooksDir,
+    claudeDir,
+    antigravityDir,
+    settingsPath: join4(claudeDir, "settings.json"),
+    backupPath: join4(claudeDir, "settings.solongate.bak"),
+    configPath: join4(sgDir, "cloud-guard.json"),
+    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
+    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
+    // covered by the passive session-log collector, not a hook.
+    antigravityHooksPath: join4(antigravityDir, "hooks.json"),
+    antigravityBackupPath: join4(antigravityDir, "hooks.solongate.bak")
+  };
+}
+function clearGuardUpdateCheck() {
+  try {
+    rmSync2(join4(globalPaths().sgDir, ".hook-update-check"), { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readHook(filename) {
+  return readFileSync4(join4(HOOKS_DIR, filename), "utf-8");
+}
+function firstAccountCredential() {
+  try {
+    const raw = JSON.parse(readFileSync4(join4(homedir2(), ".solongate", "accounts.json"), "utf-8"));
+    if (Array.isArray(raw)) {
+      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
+      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
+    }
+  } catch {
+  }
+  return {};
+}
+function readGuard() {
+  const bundled = join4(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync3(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
+}
+function antigravityHookCommand(guardAbs) {
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
+}
+function installAntigravityGuard(p, guardAbs) {
+  mkdirSync3(p.antigravityDir, { recursive: true });
+  let existing = {};
+  if (existsSync3(p.antigravityHooksPath)) {
+    const raw = readFileSync4(p.antigravityHooksPath, "utf-8");
+    if (!existsSync3(p.antigravityBackupPath)) writeFileSync3(p.antigravityBackupPath, raw);
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+  }
+  const merged = {
+    ...existing,
+    [ANTIGRAVITY_GROUP]: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+    }
+  };
+  writeFileSync3(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
+}
+function removeAntigravityGuard(p) {
+  if (!existsSync3(p.antigravityHooksPath)) return;
+  try {
+    const s = JSON.parse(readFileSync4(p.antigravityHooksPath, "utf-8"));
+    if (!(ANTIGRAVITY_GROUP in s)) return;
+    delete s[ANTIGRAVITY_GROUP];
+    writeFileSync3(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
+  } catch {
+  }
+}
+function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((res) => rl.question(question, (a) => {
+    rl.close();
+    res(a.trim());
+  }));
+}
+function runGlobalRestore() {
+  const p = globalPaths();
+  unlockProtected();
+  removeClaudeShim();
+  removeAntigravityGuard(p);
+  if (existsSync3(p.backupPath)) {
+    writeFileSync3(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
+    console.log(`  Restored ${p.settingsPath} from backup.`);
+  } else if (existsSync3(p.settingsPath)) {
+    try {
+      const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+      delete s.hooks;
+      writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
+    } catch {
+    }
+  } else {
+    console.log("  Nothing to restore \u2014 no global Claude Code settings found.");
+  }
+  console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
+}
+function installGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) {
+      const acc = firstAccountCredential();
+      if (acc.apiKey) {
+        apiKey = acc.apiKey;
+        if (acc.apiUrl) apiUrl = acc.apiUrl;
+      }
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync3(p.hooksDir, { recursive: true });
+    mkdirSync3(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync3(p.settingsPath)) {
+      const raw = readFileSync4(p.settingsPath, "utf-8");
+      if (!existsSync3(p.backupPath)) writeFileSync3(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join4(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    try {
+      installAntigravityGuard(p, join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
+    } catch {
+    }
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
+function installedGuardVersion() {
+  try {
+    const p = globalPaths();
+    const s = readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8");
+    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : null;
+  } catch {
+    return null;
+  }
+}
+function guardHookOutdated() {
+  try {
+    const p = globalPaths();
+    return readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
+  } catch {
+    return false;
+  }
+}
+function isGuardInstalled() {
+  try {
+    const p = globalPaths();
+    if (!existsSync3(p.settingsPath)) return false;
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
+  } catch {
+    return false;
+  }
+}
+function uninstallGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    unlockProtected();
+    removeClaudeShim();
+    try {
+      removeAntigravityGuard(p);
+    } catch {
+    }
+    if (!existsSync3(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    delete s.hooks;
+    writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+    return { ok: true, message: "guard removed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveRealClaude() {
+  try {
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    if (process.platform === "win32") {
+      const low = (s) => s.toLowerCase();
+      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
+    }
+    return out2[0] || null;
+  } catch {
+    return null;
+  }
+}
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
+  }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync3(f));
+}
+function writeShimBlock(file, block2) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync3(file) ? readFileSync4(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block2) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block2 + "\n";
+  }
+  mkdirSync3(dirname(file), { recursive: true });
+  writeFileSync3(file, content);
+}
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-open `solongate` \u2192 Settings \u2192 guard.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block2 = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) return;
+  for (const file of targets) {
+    try {
+      writeShimBlock(file, block2);
+    } catch {
+    }
+  }
+}
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
+    try {
+      writeShimBlock(file, null);
+    } catch {
+    }
+  }
+}
+async function runGlobalInstall(opts = {}) {
+  const p = globalPaths();
+  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
+    } catch {
+    }
+  }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    const acc = firstAccountCredential();
+    if (acc.apiKey) apiKey = acc.apiKey;
+  }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
+  }
+  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
+    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
+    process.exit(1);
+  }
+  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+  mkdirSync3(p.hooksDir, { recursive: true });
+  mkdirSync3(p.claudeDir, { recursive: true });
+  unlockProtected();
+  writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
+  installClaudeShim(join4(p.hooksDir, "shield.mjs"));
+  writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  console.log(`  Wrote ${p.configPath}`);
+  let existing = {};
+  if (existsSync3(p.settingsPath)) {
+    const raw = readFileSync4(p.settingsPath, "utf-8");
+    if (!existsSync3(p.backupPath)) {
+      writeFileSync3(p.backupPath, raw);
+      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
+    }
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+  }
+  const guardAbs = join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join4(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join4(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
+  const merged = {
+    ...existing,
+    hooks: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
+      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
+    }
+  };
+  writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
+  try {
+    installAntigravityGuard(p, guardAbs);
+    console.log(`  Registered Antigravity CLI guard \u2192 ${p.antigravityHooksPath}`);
+  } catch {
+  }
+  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
+    lockProtected();
+    console.log("  Locked protection files (OS-level read-only/immutable).");
+  }
+}
+async function installGlobalWithKey(apiKey, apiUrl) {
+  await runGlobalInstall({ apiKey, apiUrl });
+}
+var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, SHIM_BEGIN, SHIM_END;
+var init_global_install = __esm({
+  "src/global-install.ts"() {
+    "use strict";
+    __dirname = dirname(fileURLToPath(import.meta.url));
+    HOOKS_DIR = resolve3(__dirname, "..", "hooks");
+    ANTIGRAVITY_GROUP = "solongate-guard";
+    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+    SHIM_END = "# <<< SolonGate shield <<<";
+  }
+});
+
 // src/self-update.ts
 var self_update_exports = {};
 __export(self_update_exports, {
@@ -6194,16 +6664,17 @@ __export(self_update_exports, {
   latestVersion: () => latestVersion,
   maybeSelfUpdate: () => maybeSelfUpdate,
   newerThan: () => newerThan,
+  runUpdateCommand: () => runUpdateCommand,
   tuiUpdateFlow: () => tuiUpdateFlow
 });
 import { execFile, spawn } from "child_process";
-import { mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, join as join4 } from "path";
-import { fileURLToPath } from "url";
+import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function readState() {
   try {
-    const s = JSON.parse(readFileSync4(STATE_FILE, "utf-8"));
+    const s = JSON.parse(readFileSync5(STATE_FILE, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -6211,14 +6682,14 @@ function readState() {
 }
 function writeState(s) {
   try {
-    mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
-    writeFileSync3(STATE_FILE, JSON.stringify(s));
+    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    writeFileSync4(STATE_FILE, JSON.stringify(s));
   } catch {
   }
 }
 function currentVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync5(join5(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -6254,7 +6725,7 @@ async function fetchLatest() {
 }
 function spawnGlobalInstall(version) {
   try {
-    mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
+    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
     const log3 = openSync(LOG_FILE, "a");
     const p = spawn("npm", ["install", "-g", `${PKG}@${version}`], {
       stdio: ["ignore", log3, log3],
@@ -6270,17 +6741,45 @@ function spawnGlobalInstall(version) {
     return false;
   }
 }
-function runGlobalInstall(version) {
+async function runUpdateCommand() {
+  const out2 = (s) => void process.stderr.write(s + "\n");
+  const cur = currentVersion();
+  out2(`  current  ${cur}`);
+  const latest = await latestVersion();
+  if (!latest) {
+    out2("  could not reach the npm registry. Try again, or: npm i -g @solongate/proxy@latest");
+    return 1;
+  }
+  if (newerThan(latest, cur)) {
+    out2(`  updating ${cur} -> ${latest} ...`);
+    const ok = await runGlobalInstall2(latest);
+    if (!ok) {
+      out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+      return 1;
+    }
+    out2(`  \u2713 updated to ${latest}  (open a new session to use it)`);
+  } else {
+    out2(`  \u2713 already up to date`);
+  }
+  try {
+    const { installGlobalQuiet: installGlobalQuiet2, installedGuardVersion: installedGuardVersion2 } = await Promise.resolve().then(() => (init_global_install(), global_install_exports));
+    const r = installGlobalQuiet2();
+    out2(r.ok ? `  \u2713 guard hooks refreshed (v${installedGuardVersion2() ?? "?"})` : `  guard: ${r.message}`);
+  } catch {
+  }
+  return 0;
+}
+function runGlobalInstall2(version) {
   return new Promise((resolve6) => {
     try {
-      mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
+      mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
       execFile(
         "npm",
         ["install", "-g", `${PKG}@${version}`],
         { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
         (err2, stdout, stderr) => {
           try {
-            writeFileSync3(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
+            writeFileSync4(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
 ${stdout}
 ${stderr}
 `, { flag: "a" });
@@ -6306,7 +6805,7 @@ async function tuiUpdateFlow(onStatus) {
       return;
     }
     onStatus({ kind: "updating", version: latest });
-    if (await runGlobalInstall(latest)) {
+    if (await runGlobalInstall2(latest)) {
       writeState({ ...readState(), installed: latest });
       onStatus({ kind: "updated", version: latest });
     }
@@ -6345,8 +6844,8 @@ var init_self_update = __esm({
     PKG = "@solongate/proxy";
     CHECK_EVERY_MS = 30 * 60 * 1e3;
     ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
-    STATE_FILE = join4(homedir2(), ".solongate", ".self-update.json");
-    LOG_FILE = join4(homedir2(), ".solongate", "self-update.log");
+    STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
+    LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
   }
 });
 
@@ -6361,13 +6860,13 @@ __export(logs_server_daemon_exports, {
   stopLogsServerDaemon: () => stopLogsServerDaemon
 });
 import { spawn as spawn2 } from "child_process";
-import { mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join6 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function readState2() {
   try {
-    const s = JSON.parse(readFileSync5(STATE_FILE2, "utf-8"));
+    const s = JSON.parse(readFileSync6(STATE_FILE2, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -6375,8 +6874,8 @@ function readState2() {
 }
 function writeState2(s) {
   try {
-    mkdirSync4(DIR, { recursive: true });
-    writeFileSync4(STATE_FILE2, JSON.stringify(s));
+    mkdirSync5(DIR, { recursive: true });
+    writeFileSync5(STATE_FILE2, JSON.stringify(s));
   } catch {
   }
 }
@@ -6404,13 +6903,16 @@ function startLogsServerDaemon() {
     return { ...cur, desired: "on" };
   }
   try {
-    mkdirSync4(DIR, { recursive: true });
+    mkdirSync5(DIR, { recursive: true });
     const log3 = openSync2(LOG_FILE2, "a");
-    const cli = join5(dirname2(fileURLToPath2(import.meta.url)), "index.js");
+    const cli = join6(dirname3(fileURLToPath3(import.meta.url)), "index.js");
     const p = spawn2(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log3, log3],
-      windowsHide: true
+      windowsHide: true,
+      // Spawned by US, not by an agent: exempt from the human-only TTY gate
+      // (a detached daemon has no terminal by definition).
+      env: { ...process.env, SOLONGATE_INTERNAL: "1" }
     });
     p.on("error", () => {
     });
@@ -6443,22 +6945,22 @@ var DIR, STATE_FILE2, LOG_FILE2, LOGS_SERVER_PORT;
 var init_logs_server_daemon = __esm({
   "src/logs-server-daemon.ts"() {
     "use strict";
-    DIR = join5(homedir3(), ".solongate");
-    STATE_FILE2 = join5(DIR, ".logs-server.json");
-    LOG_FILE2 = join5(DIR, "logs-server.log");
+    DIR = join6(homedir4(), ".solongate");
+    STATE_FILE2 = join6(DIR, ".logs-server.json");
+    LOG_FILE2 = join6(DIR, "logs-server.log");
     LOGS_SERVER_PORT = 8788;
   }
 });
 
 // src/tui/config.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
 function loadConfig() {
   if (cached) return cached;
   const defaults = { notifications: true };
   try {
-    const raw = readFileSync6(join6(homedir4(), ".solongate", "tui-config.json"), "utf-8");
+    const raw = readFileSync7(join7(homedir5(), ".solongate", "tui-config.json"), "utf-8");
     const j = JSON.parse(raw);
     cached = {
       notifications: j.notifications !== false,
@@ -6629,9 +7131,9 @@ var init_components = __esm({
 });
 
 // src/tui/local-log.ts
-import { closeSync, openSync as openSync3, readFileSync as readFileSync7, readSync, statSync, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { closeSync, openSync as openSync3, readFileSync as readFileSync8, readSync, statSync, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
 function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
@@ -6649,7 +7151,7 @@ function tailLines(file, maxBytes = 131072) {
 }
 function deleteLocalEntry(at, tool, session) {
   try {
-    const lines = readFileSync7(LOCAL_LOG, "utf-8").split("\n");
+    const lines = readFileSync8(LOCAL_LOG, "utf-8").split("\n");
     let removed = 0;
     const kept = lines.filter((line) => {
       if (!line.trim()) return false;
@@ -6665,7 +7167,7 @@ function deleteLocalEntry(at, tool, session) {
       }
       return true;
     });
-    if (removed) writeFileSync5(LOCAL_LOG, kept.length ? kept.join("\n") + "\n" : "");
+    if (removed) writeFileSync6(LOCAL_LOG, kept.length ? kept.join("\n") + "\n" : "");
     return removed;
   } catch {
     return 0;
@@ -6673,8 +7175,8 @@ function deleteLocalEntry(at, tool, session) {
 }
 function clearLocalLog() {
   try {
-    const n = readFileSync7(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
-    writeFileSync5(LOCAL_LOG, "");
+    const n = readFileSync8(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
+    writeFileSync6(LOCAL_LOG, "");
     return n;
   } catch {
     return 0;
@@ -6705,20 +7207,20 @@ var LOCAL_LOG, DLP_REASON, RL_REASON;
 var init_local_log = __esm({
   "src/tui/local-log.ts"() {
     "use strict";
-    LOCAL_LOG = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
     DLP_REASON = /security layer \(dlp\)/i;
     RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
   }
 });
 
 // src/api-client/client.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, existsSync as existsSync3 } from "fs";
-import { resolve as resolve3, join as join8 } from "path";
-import { homedir as homedir6 } from "os";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync4 } from "fs";
+import { resolve as resolve4, join as join9 } from "path";
+import { homedir as homedir7 } from "os";
 function listAccounts() {
   let list5 = [];
   try {
-    const raw = JSON.parse(readFileSync8(accountsFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
     if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
   } catch {
   }
@@ -6732,7 +7234,7 @@ function saveAccount(acc) {
   try {
     const list5 = (() => {
       try {
-        const raw = JSON.parse(readFileSync8(accountsFile(), "utf-8"));
+        const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
         return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
       } catch {
         return [];
@@ -6740,8 +7242,8 @@ function saveAccount(acc) {
     })();
     const next = list5.filter((a) => a.apiKey !== acc.apiKey);
     next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
-    mkdirSync5(join8(homedir6(), ".solongate"), { recursive: true });
-    writeFileSync6(accountsFile(), JSON.stringify(next, null, 2));
+    mkdirSync6(join9(homedir7(), ".solongate"), { recursive: true });
+    writeFileSync7(accountsFile(), JSON.stringify(next, null, 2));
   } catch {
   }
 }
@@ -6749,13 +7251,13 @@ function removeAccount(apiKey) {
   try {
     const list5 = (() => {
       try {
-        const raw = JSON.parse(readFileSync8(accountsFile(), "utf-8"));
+        const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
         return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
       } catch {
         return [];
       }
     })();
-    writeFileSync6(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
+    writeFileSync7(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
   } catch {
   }
 }
@@ -6768,15 +7270,15 @@ function isActiveAccount(apiKey) {
 }
 function setActiveAccount(creds) {
   try {
-    const dir = join8(homedir6(), ".solongate");
-    mkdirSync5(dir, { recursive: true });
-    const p = join8(dir, ["cloud", "guard.json"].join("-"));
+    const dir = join9(homedir7(), ".solongate");
+    mkdirSync6(dir, { recursive: true });
+    const p = join9(dir, ["cloud", "guard.json"].join("-"));
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync8(p, "utf-8"));
+      existing = JSON.parse(readFileSync9(p, "utf-8"));
     } catch {
     }
-    writeFileSync6(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
+    writeFileSync7(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
     cached2 = null;
     return true;
   } catch {
@@ -6785,19 +7287,19 @@ function setActiveAccount(creds) {
 }
 function clearActiveCredential() {
   try {
-    const p = join8(homedir6(), ".solongate", ["cloud", "guard.json"].join("-"));
-    if (!existsSync3(p)) {
+    const p = join9(homedir7(), ".solongate", ["cloud", "guard.json"].join("-"));
+    if (!existsSync4(p)) {
       cached2 = null;
       return true;
     }
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync8(p, "utf-8"));
+      existing = JSON.parse(readFileSync9(p, "utf-8"));
     } catch {
     }
     delete existing.apiKey;
     delete existing.apiUrl;
-    writeFileSync6(p, JSON.stringify(existing, null, 2));
+    writeFileSync7(p, JSON.stringify(existing, null, 2));
     cached2 = null;
     viewOverride = null;
     return true;
@@ -6807,9 +7309,9 @@ function clearActiveCredential() {
 }
 function loginCredentialFile() {
   try {
-    const p = join8(homedir6(), ".solongate", "cloud-guard.json");
-    if (!existsSync3(p)) return {};
-    const c2 = JSON.parse(readFileSync8(p, "utf-8"));
+    const p = join9(homedir7(), ".solongate", "cloud-guard.json");
+    if (!existsSync4(p)) return {};
+    const c2 = JSON.parse(readFileSync9(p, "utf-8"));
     return c2 && typeof c2 === "object" ? c2 : {};
   } catch {
     return {};
@@ -6817,9 +7319,9 @@ function loginCredentialFile() {
 }
 function dotenvApiKey() {
   try {
-    const envPath = resolve3(".env");
-    if (!existsSync3(envPath)) return void 0;
-    for (const line of readFileSync8(envPath, "utf-8").split("\n")) {
+    const envPath = resolve4(".env");
+    if (!existsSync4(envPath)) return void 0;
+    for (const line of readFileSync9(envPath, "utf-8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
       const eq = trimmed.indexOf("=");
@@ -6922,7 +7424,7 @@ var init_client = __esm({
   "src/api-client/client.ts"() {
     "use strict";
     DEFAULT_API_URL2 = "https://api.solongate.com";
-    accountsFile = () => join8(homedir6(), ".solongate", "accounts.json");
+    accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
     viewOverride = null;
     ApiError = class extends Error {
       status;
@@ -7413,9 +7915,9 @@ var init_hooks = __esm({
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join10 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function extractTarget(detail) {
@@ -7973,10 +8475,10 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join9(homedir7(), ".solongate", "live-export.jsonl");
+        const file = join10(homedir8(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync6(join9(homedir7(), ".solongate"), { recursive: true });
-          writeFileSync7(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
+          mkdirSync7(join10(homedir8(), ".solongate"), { recursive: true });
+          writeFileSync8(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
           setActionMsg({ text: "\u2717 export failed: " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 6e3 });
@@ -8387,7 +8889,7 @@ var init_Live = __esm({
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
-    RING = join9(process.cwd(), ".solongate", ".eval-ring.jsonl");
+    RING = join10(process.cwd(), ".solongate", ".eval-ring.jsonl");
     fmtUp = (ms) => {
       const s = Math.floor(ms / 1e3);
       const p = (n) => String(n).padStart(2, "0");
@@ -9390,9 +9892,9 @@ var init_Dlp = __esm({
 // src/tui/panels/Audit.tsx
 import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import TextInput5 from "ink-text-input";
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join11 } from "path";
 import { useState as useState7 } from "react";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 function loadLocalRows() {
@@ -9542,16 +10044,16 @@ function AuditPanel({ active: active2, focused }) {
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
     const run10 = async () => {
-      const dir = join10(homedir8(), ".solongate");
-      const file = join10(dir, `audit-export-${source}.jsonl`);
+      const dir = join11(homedir9(), ".solongate");
+      const file = join11(dir, `audit-export-${source}.jsonl`);
       let rows2;
       if (kind === "page") rows2 = pageRows;
       else if (source === "cloud") {
         const r = await api.audit.list({ ...query, limit: 1e4, offset: 0 });
         rows2 = r.entries.map(cloudRow).sort((a, b) => b.at - a.at);
       } else rows2 = localFiltered;
-      mkdirSync7(dir, { recursive: true });
-      writeFileSync8(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
+      mkdirSync8(dir, { recursive: true });
+      writeFileSync9(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
     run10().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
@@ -10022,312 +10524,6 @@ var init_Audit = __esm({
   }
 });
 
-// src/global-install.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync9, existsSync as existsSync4, mkdirSync as mkdirSync8, rmSync as rmSync2 } from "fs";
-import { resolve as resolve4, join as join11, dirname as dirname3 } from "path";
-import { homedir as homedir9 } from "os";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { createInterface } from "readline";
-import { execFileSync as execFileSync2 } from "child_process";
-function lockFile(file) {
-  if (!existsSync4(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync4(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join11(p.hooksDir, "guard.mjs"),
-    join11(p.hooksDir, "audit.mjs"),
-    join11(p.hooksDir, "stop.mjs"),
-    join11(p.hooksDir, "shield.mjs"),
-    p.configPath,
-    p.settingsPath,
-    p.antigravityHooksPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir9();
-  const sgDir = join11(home, ".solongate");
-  const hooksDir = join11(sgDir, "hooks");
-  const claudeDir = join11(home, ".claude");
-  const antigravityDir = join11(home, ".gemini", "config");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    antigravityDir,
-    settingsPath: join11(claudeDir, "settings.json"),
-    backupPath: join11(claudeDir, "settings.solongate.bak"),
-    configPath: join11(sgDir, "cloud-guard.json"),
-    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
-    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
-    // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join11(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join11(antigravityDir, "hooks.solongate.bak")
-  };
-}
-function readHook(filename) {
-  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
-}
-function firstAccountCredential() {
-  try {
-    const raw = JSON.parse(readFileSync9(join11(homedir9(), ".solongate", "accounts.json"), "utf-8"));
-    if (Array.isArray(raw)) {
-      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
-      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
-    }
-  } catch {
-  }
-  return {};
-}
-function readGuard() {
-  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
-}
-function antigravityHookCommand(guardAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
-}
-function installAntigravityGuard(p, guardAbs) {
-  mkdirSync8(p.antigravityDir, { recursive: true });
-  let existing = {};
-  if (existsSync4(p.antigravityHooksPath)) {
-    const raw = readFileSync9(p.antigravityHooksPath, "utf-8");
-    if (!existsSync4(p.antigravityBackupPath)) writeFileSync9(p.antigravityBackupPath, raw);
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const merged = {
-    ...existing,
-    [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
-    }
-  };
-  writeFileSync9(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
-}
-function removeAntigravityGuard(p) {
-  if (!existsSync4(p.antigravityHooksPath)) return;
-  try {
-    const s = JSON.parse(readFileSync9(p.antigravityHooksPath, "utf-8"));
-    if (!(ANTIGRAVITY_GROUP in s)) return;
-    delete s[ANTIGRAVITY_GROUP];
-    writeFileSync9(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
-  } catch {
-  }
-}
-function installGlobalQuiet() {
-  try {
-    const p = globalPaths();
-    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
-    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-    try {
-      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
-      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
-    } catch {
-    }
-    if (!apiKey) {
-      const acc = firstAccountCredential();
-      if (acc.apiKey) {
-        apiKey = acc.apiKey;
-        if (acc.apiUrl) apiUrl = acc.apiUrl;
-      }
-    }
-    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
-    mkdirSync8(p.hooksDir, { recursive: true });
-    mkdirSync8(p.claudeDir, { recursive: true });
-    unlockProtected();
-    writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
-    writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-    writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-    writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-    writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-    let existing = {};
-    if (existsSync4(p.settingsPath)) {
-      const raw = readFileSync9(p.settingsPath, "utf-8");
-      if (!existsSync4(p.backupPath)) writeFileSync9(p.backupPath, raw);
-      try {
-        existing = JSON.parse(raw);
-      } catch {
-        existing = {};
-      }
-    }
-    const nodeBin = process.execPath.replace(/\\/g, "/");
-    const call = process.platform === "win32" ? "& " : "";
-    const hookCmd = (script) => `${call}"${nodeBin}" "${join11(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
-    const merged = {
-      ...existing,
-      hooks: {
-        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
-        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
-        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
-      }
-    };
-    writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-    try {
-      installAntigravityGuard(p, join11(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
-    } catch {
-    }
-    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
-    return { ok: true, message: "guard installed (open a new session)" };
-  } catch (e) {
-    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-  }
-}
-function installedGuardVersion() {
-  try {
-    const p = globalPaths();
-    const s = readFileSync9(join11(p.hooksDir, "guard.mjs"), "utf-8");
-    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
-    return m ? parseInt(m[1], 10) : null;
-  } catch {
-    return null;
-  }
-}
-function guardHookOutdated() {
-  try {
-    const p = globalPaths();
-    return readFileSync9(join11(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
-  } catch {
-    return false;
-  }
-}
-function isGuardInstalled() {
-  try {
-    const p = globalPaths();
-    if (!existsSync4(p.settingsPath)) return false;
-    const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
-    return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
-  } catch {
-    return false;
-  }
-}
-function uninstallGlobalQuiet() {
-  try {
-    const p = globalPaths();
-    unlockProtected();
-    removeClaudeShim();
-    try {
-      removeAntigravityGuard(p);
-    } catch {
-    }
-    if (!existsSync4(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
-    const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
-    delete s.hooks;
-    writeFileSync9(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-    return { ok: true, message: "guard removed (open a new session)" };
-  } catch (e) {
-    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-  }
-}
-function escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function shimTargets() {
-  if (process.platform === "win32") {
-    try {
-      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
-      return prof ? [prof] : [];
-    } catch {
-      return [];
-    }
-  }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join11(homedir9(), f)).filter((f) => existsSync4(f));
-}
-function writeShimBlock(file, block2) {
-  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync9(file, "utf-8") : "";
-  content = content.replace(re, "");
-  if (block2) {
-    if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block2 + "\n";
-  }
-  mkdirSync8(dirname3(file), { recursive: true });
-  writeFileSync9(file, content);
-}
-function removeClaudeShim() {
-  for (const file of shimTargets()) {
-    try {
-      writeShimBlock(file, null);
-    } catch {
-    }
-  }
-}
-var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, SHIM_BEGIN, SHIM_END;
-var init_global_install = __esm({
-  "src/global-install.ts"() {
-    "use strict";
-    __dirname = dirname3(fileURLToPath3(import.meta.url));
-    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
-    ANTIGRAVITY_GROUP = "solongate-guard";
-    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
-    SHIM_END = "# <<< SolonGate shield <<<";
-  }
-});
-
 // src/tui/panels/Settings.tsx
 import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput6 from "ink-text-input";
@@ -15862,7 +16058,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -15923,6 +16119,7 @@ function printHelp() {
   console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}   ${c.dim}(no command opens the dataroom: all of this in a terminal UI)${c.reset}`);
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
+  cmd("update", "update SolonGate to the newest version and refresh the guard");
   cmd("doctor", "health check: login, policy, guard, local logs");
   cmd("doctor --json", "the same health check as machine-readable JSON");
   cmd("logs-server start", "start the local audit-log service for the dashboard (background)");
@@ -15970,8 +16167,38 @@ function printHelp() {
   console.log(`  ${c.dim}Details for a command: ${c.reset}${c.cyan}solongate <command> help${c.reset}${c.dim}  \xB7  Dashboard: ${c.reset}${c.cyan}https://dashboard.solongate.com${c.reset}`);
   console.log("");
 }
+var AGENT_ENV_MARKERS = [
+  "CLAUDECODE",
+  "CLAUDE_CODE",
+  "CLAUDE_CODE_ENTRYPOINT",
+  "ANTIGRAVITY",
+  "ANTIGRAVITY_CLI",
+  "GEMINI_CLI",
+  "CURSOR_TRACE_ID",
+  "AIDER_CHAT",
+  "OPENAI_CODEX",
+  "CODEX_SANDBOX",
+  "OPENCLAW",
+  "REPLIT_CLI",
+  "DEVIN_session"
+];
+function assertHumanTerminal() {
+  if (process.env["SOLONGATE_INTERNAL"] === "1") return;
+  const marker = AGENT_ENV_MARKERS.find((k) => process.env[k]);
+  const isTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (isTty && !marker) return;
+  const w = (s) => void process.stderr.write(s + "\n");
+  w("");
+  w("  SolonGate is human-only.");
+  w("  These commands control your security policy, so they cannot be run by an AI");
+  w("  agent or any non-interactive process. Run them yourself, in a terminal.");
+  w(marker ? `  (refused: agent environment detected via ${marker})` : "  (refused: no interactive terminal)");
+  w("");
+  process.exit(1);
+}
 async function main() {
   const subcommand = process.argv[2];
+  if (IS_HUMAN_CLI) assertHumanTerminal();
   if (subcommand === "--help" || subcommand === "-h" || subcommand === "help") {
     printHelp();
     return;
@@ -16018,6 +16245,10 @@ async function main() {
     console.log("");
     return;
   }
+  if (subcommand === "update") {
+    const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
+    process.exit(await runUpdateCommand2());
+  }
   if (subcommand === "logs-server" || subcommand === "local-logs") {
     const { runLogsServer: runLogsServer2 } = await Promise.resolve().then(() => (init_logs_server(), logs_server_exports));
     await runLogsServer2();